PT-2026-24168 · Glance · Glance

Neo-Ai-Engineer + 1 · Published 2026-03-09 · Updated 2026-03-18 · CVE-2026-30930

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Glances versions prior to 4.5.1

Description Glances, a cross-platform system monitoring tool, contains a flaw in its TimescaleDB export module. The module builds SQL queries by concatenating strings with unverified system monitoring data. The normalize() function encloses string values in single quotes but does not escape any embedded single quotes, which allows for trivial SQL injection. Attackers can control data like process names, filesystem mount points, network interface names, and container names to exploit this issue. The vulnerability resides in the normalize() function within glances/exports/glances timescaledb/ init .py (lines 79-93) and the query construction section (lines 201-205). A proof of concept demonstrates that a normal user can create a process with a name containing a SQL injection payload, and then, when Glances is started with TimescaleDB export, a file is created in the /tmp directory, indicating successful SQL injection. Potential impacts include data destruction, data exfiltration, potential remote code execution, and privilege escalation. The vulnerability is due to the direct execution of concatenated SQL queries without using parameterized queries.

Recommendations Versions prior to 4.5.1 should be updated to version 4.5.1 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-30930

GHSA-X46R-MF5G-XPR6

Affected Products

Glance

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30930.json · Exploit
• https://github.com/nicolargo/glances/security/advisories/GHSA-x46r-mf5g-xpr6 · Vendor Advisory
• https://github.com/nicolargo/glances/commit/39161f0d6fd723d83f534b48f24cdca722573336 · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-30930 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-30930 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-30930 · Security Note
• https://osv.dev/vulnerability/GHSA-x46r-mf5g-xpr6 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-30930 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-30930 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-30930 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30930 · Security Note
• https://github.com/nicolargo/glances · Note
• https://github.com/nicolargo/glances/releases/tag/v4.5.1 · Note
• https://twitter.com/CVEnew/status/2034136487244046823 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1rpx2ut/resumen_diario_de_vulnerabilidades_10032026 · Reddit Post